Malware Detections by Sender Country

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) that originate from geographically inconsistent or high-risk sender countries to bypass initial email security controls. Proactively hunting for these patterns in Azure Sentinel allows the SOC to identify potential supply chain compromises or targeted intrusion attempts that may have evaded real-time detection, ensuring rapid containment of malware-laden emails before they reach user inboxes.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| where ThreatTypes has "Malware" and isnotempty(SenderIPv4)
| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
| extend Country = tostring(GeoInfo.country)
| summarize count() by Country
| project Country, ['Malware Emails'] = count_
| sort by ['Malware Emails'] desc

Analytic Rule Definition

id: 2e1c439b-9bbf-4d1a-a8c1-2a9f9149f3e5
name: Malware Detections by Sender Country
description: |
  This query summarises inbound email malware detections by the sender IP address country, derived from the sender IPv4 address.
description-detailed: |
  This query summarises inbound email malware detections in Microsoft Defender for Office 365 by the sender IP address country, derived from the sender IPv4 address using geo_info_from_ip_address.
  Messages are de-duplicated to the latest record per NetworkMessageId and recipient, and deliveries to the SecOps mailbox and by the phishing simulation system are excluded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | extend Key = strcat(NetworkMessageId, "-", RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ThreatTypes has "Malware" and isnotempty(SenderIPv4)
  | extend GeoInfo = geo_info_from_ip_address(SenderIPv4)
  | extend Country = tostring(GeoInfo.country)
  | summarize count() by Country
  | project Country, ['Malware Emails'] = count_
  | sort by ['Malware Emails'] desc
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Malware Detections by Sender Country.yaml)

False Positive Guidance

• Scenario: Automated security scans or vulnerability assessments initiated by external vendors or cloud providers (e.g., AWS, Azure) where the scanning infrastructure is hosted in a region different from the primary business operations, triggering malware signatures on test payloads or benign scan artifacts.

  • Filter/Exclusion: Exclude sender IPs associated with known vendor CIDR ranges (e.g., 13.107.0.0/16 for Microsoft, 52.0.0.0/8 for AWS) or add specific sender domains (e.g., @aws.com, @azure.com) to the exclusion list if the scan traffic is expected.

• Scenario: Scheduled backup or synchronization jobs from offsite data centers or disaster recovery sites that are geographically distant from the primary office, where the backup agent sends status reports or encrypted chunks that occasionally match generic malware heuristics due to high entropy or specific file headers.

  • Filter/Exclusion: Exclude sender IPs belonging to the organization’s known DR or backup infrastructure (e.g., 10.20.0.0/24 for DR site) or filter by specific service accounts (e.g., backup-agent@corp.local) used for these automated jobs.

• Scenario: Third-party SaaS integrations or API webhooks (e.g., Jira, Salesforce, Slack) that send automated notifications or file attachments from cloud regions (e.g., us-east-1 vs. eu-west-1) that may not align with the expected “home” country, especially when the attachment is a PDF or image that triggers a false positive in the malware engine.

  • Filter/Exclusion: Exclude sender domains for known SaaS providers (e.g., @salesforce.com, @jira.atlassian.com, @slack.com) or filter by specific API gateway IPs if